SECURE AND LIGHTWEIGHT HARDWARE AUTHENTICATION USING ISOLATED PHYSICAL UNCLONABLE FUNCTION

As embedded computers become ubiquitous, mobile and more integrated in connectivity, user dependence on integrated circuits (ICs) increases massively for handling security sensitive tasks as well as processing sensitive information. During this process, hardware authentication is important to prevent unauthorized users or devices from gaining access to secret information. An effective method for hardware authentication is by using physical unclonable function (PUF), which is a hardware design that leverages intrinsic unique physical characteristics of an IC, such as propagation delay, for security authentication in real time. However, PUF is vulnerable to modeling attacks, as one can design an algorithm to imitate PUF functionality at the software level given a sufficient set of challenge-response pairs (CRPs). To address the problem, we employ hardware isolation primitives (e.g., ARM TrustZone) to protect PUF. The key idea is to physically isolate the system resources that handle security-sensitive information from the regular ones. This technique can be implemented by isolating and strictly controlling any connection between the secure and normal resources. We design and implement a ring oscillator (RO)-based PUF with hardware isolation protection using ARM TrustZone. Our PUF design heavily limits the number of CRPs a potential attacker has access to. Therefore, the modeling attack cannot be performed accurately enough to guess the response of the PUF to a challenge. Furthermore, we develop and demonstrate a brand new application for the designed PUF, namely multimedia authentication, which is an integral part of multimedia signal processing in many real-time and security sensitive applications. We show that the PUF-based hardware security approach is capable of accomplishing the authentication for both the hardware device and the multimedia stream while introducing minimum overhead. Finally, we evaluate the hardware-isolated PUF design using a prototype implementation on a Xilinx system on chip (SoC). Particularly, we conduct functional evaluation (i.e., randomness, uniqueness, and correctness), security analysis against modeling attacks, as well as performance and overhead evaluation (i.e., response time and resource usages). Our experimental results on the real hardware demonstrate the high security and low overhead of the PUF in real time authentication. Advisor: Sheng We

SECURE AND LIGHTWEIGHT HARDWARE AUTHENTICATION USING ISOLATED PHYSICAL UNCLONABLE FUNCTION

As embedded computers become ubiquitous, mobile and more integrated in connectivity, user dependence on integrated circuits (ICs) increases massively for handling security sensitive tasks as well as processing sensitive information. During this process, hardware authentication is important to prevent unauthorized users or devices from gaining access to secret information. An effective method for hardware authentication is by using physical unclonable function (PUF), which is a hardware design that leverages intrinsic unique physical characteristics of an IC, such as propagation delay, for security authentication in real time. However, PUF is vulnerable to modeling attacks, as one can design an algorithm to imitate PUF functionality at the software level given a sufficient set of challenge-response pairs (CRPs). To address the problem, we employ hardware isolation primitives (e.g., ARM TrustZone) to protect PUF. The key idea is to physically isolate the system resources that handle security-sensitive information from the regular ones. This technique can be implemented by isolating and strictly controlling any connection between the secure and normal resources. We design and implement a ring oscillator (RO)-based PUF with hardware isolation protection using ARM TrustZone. Our PUF design heavily limits the number of CRPs a potential attacker has access to. Therefore, the modeling attack cannot be performed accurately enough to guess the response of the PUF to a challenge. Furthermore, we develop and demonstrate a brand new application for the designed PUF, namely multimedia authentication, which is an integral part of multimedia signal processing in many real-time and security sensitive applications. We show that the PUF-based hardware security approach is capable of accomplishing the authentication for both the hardware device and the multimedia stream while introducing minimum overhead. Finally, we evaluate the hardware-isolated PUF design using a prototype implementation on a Xilinx system on chip (SoC). Particularly, we conduct functional evaluation (i.e., randomness, uniqueness, and correctness), security analysis against modeling attacks, as well as performance and overhead evaluation (i.e., response time and resource usages). Our experimental results on the real hardware demonstrate the high security and low overhead of the PUF in real time authentication. Advisor: Sheng We

Using physical unclonable functions for internet-of-thing security cameras

This paper proposes a low-cost solution to develop IoT security cameras. Integrity and confidentiality of the image data are achieved by cryptographic modules that implement symmetric key-based techniques which are usually available in the hardware of the IoT cameras. The novelty of this proposal is that the secret key required is not stored but reconstructed from the start-up values of a SRAM in the camera hardware acting as a PUF (Physical Unclonable Function), so that the physical authenticity of the camera is also ensured. The start-up values of the SRAM are also exploited to change the IV (Initialization Vector) in the encryption algorithm. All the steps for enrollment and normal operation can be included in a simple firmware to be executed by the camera. There is no need to include specific hardware but only a SRAM is needed which could be powered down and up by firmware.Ministerio de Economía y Competitividad del Gobierno de España y fondos europeos FEDER-TEC2014-57971-RConsejo Superior de Investigaciones Científicas (CSIC)-HW-SEEDS 201750E010V Plan Propio de Investigación de la Universidad de Sevill

Lightweight IoT security middleware for end-to-end cloud-fog communication

Dr. Prasad Calyam, Thesis Supervisor.Field of study: Computer science."May 2017."IoT (Internet of Things) based smart devices such as sensors and wearables have been actively used in edge clouds i.e., 'fogs' to provide critical data during scenarios ranging from e.g., disaster response to in-home healthcare. Since these devices typically operate in resource constrained environments at the network-edge, end-to-end security protocols have to be lightweight while also being robust, flexible and energy-efficient for data import/ export to/from cloud platforms. In this thesis, we present the design and implementation of a lightweight IoT security middleware for end-to-end cloud-fog communications involving smart devices and cloud-hosted applications. The novelty of our middleware is in its ability to cope with intermittent network connectivity as well as device constraints in terms of computational power, memory and network bandwidth. To provide security during intermittent network conditions, we use a Session Resumption concept in order to reuse encrypted sessions from recent past, if a recently disconnected device wants to resume a prior connection that was interrupted. The primary design goal is to not only secure IoT device communications, but also to maintain security compatibility with an existing core cloud infrastructure. Experiment results show how our middleware implementation provides fast and resource-aware security by leveraging static pre-shared keys (PSKs) for a variety of IoT-based application requirements. Thus, our work lays a foundation for promoting increased adoption of static properties such as Static PSKs that can be highly suitable for handling the trade-offs in high security or faster data transfer requirements within IoT-based applications.Includes bibliographical references (pages 58-60)

Trusted Cameras on Mobile Devices Based on SRAM Physically Unclonable Functions

Nowadays, there is an increasing number of cameras placed on mobile devices connected to the Internet. Since these cameras acquire and process sensitive and vulnerable data in applications such as surveillance or monitoring, security is essential to avoid cyberattacks. However, cameras on mobile devices have constraints in size, computation and power consumption, so that lightweight security techniques should be considered. Camera identification techniques guarantee the origin of the data. Among the camera identification techniques, Physically Unclonable Functions (PUFs) allow generating unique, distinctive and unpredictable identifiers from the hardware of a device. PUFs are also very suitable to obfuscate secret keys (by binding them to the hardware of the device) and generate random sequences (employed as nonces). In this work, we propose a trusted camera based on PUFs and standard cryptographic algorithms. In addition, a protocol is proposed to protect the communication with the trusted camera, which satisfies authentication, confidentiality, integrity and freshness in the data communication. This is particularly interesting to carry out camera control actions and firmware updates. PUFs from Static Random Access Memories (SRAMs) are selected because cameras typically include SRAMs in its hardware. Therefore, additional hardware is not required and security techniques can be implemented at low cost. Experimental results are shown to prove how the proposed solution can be implemented with the SRAM of commercial Bluetooth Low Energy (BLE) chips included in the communication module of the camera. A proof of concept shows that the proposed solution can be implemented in low-cost cameras.España, Ministerio de Ciencia e Innovación TEC2014-57971-R TEC2017-83557-

IoT Security Evolution: Challenges and Countermeasures Review

Internet of Things (IoT) architecture, technologies, applications and security have been recently addressed by a number of researchers. Basically, IoT adds internet connectivity to a system of intelligent devices, machines, objects and/or people. Devices are allowed to automatically collect and transmit data over the Internet, which exposes them to serious attacks and threats. This paper provides an intensive review of IoT evolution with primary focusing on security issues together with the proposed countermeasures. Thus, it outlines the IoT security challenges as a future roadmap of research for new researchers in this domain

Implementação fotónica de funções fisicamente não clonáveis

This dissertation aimed to study and develop optical Physically Unclonable Functions, which are physical devices characterized by having random intrinsic variations, thus being eligible towards high security systems due to their unclonability, uniqueness and randomness. With the rapid expansion of technologies such as Internet of Things and the concerns around counterfeited goods, secure and resilient cryptographic systems are in high demand. Moreover the development of digital ecosystems, mobile applications towards transactions now require fast and reliable algorithms to generate secure cryptographic keys. The statistical nature of speckle-based imaging creates an opportunity for these cryptographic key generators to arise. In the scope of this work, three different tokens were implemented as physically unclonable devices: tracing paper, plastic optical fiber and an organic-inorganic hybrid. These objects were subjected to a visible light laser stimulus and produced a speckle pattern which was then used to retrieve the cryptographic key associated to each of the materials. The methodology deployed in this work features the use of a Discrete Cosine Transform to enable a low-cost and semi-compact 128-bit key encryption channel. Furthermore, the authentication protocol required the analysis of multiple responses from different samples, establishing an optimal decision threshold level that maximized the robustness and minimized the fallibility of the system. The attained 128-bit encryption system performed, across all the samples, bellow the error probability detection limit of 10-12, showing its potential as a cryptographic key generator.Nesta dissertação pretende-se estudar e desenvolver Funções Fisicamente Não Clonáveis, dispositivos caracterizados por terem variações aleatórias intrínsecas, sendo, portanto, elegíveis para sistemas de alta segurança devido à sua impossibilidade de clonagem, unicidade e aleatoriedade. Com a rápida expansão de tecnologias como a Internet das Coisas e as preocupações com produtos falsificados, os sistemas criptográficos seguros e resilientes são altamente requisitados. Além disso, o desenvolvimento de ecossistemas digitais e de aplicações móveis para transações comerciais requerem algoritmos rápidos e seguros de geração de chaves criptográficas. A natureza estatística das imagens baseadas no speckle cria uma oportunidade para o aparecimento desses geradores de chaves criptográficas. No contexto deste trabalho, três dispositivos diferentes foram implementados como funções fisicamente não clonáveis, nomeadamente, papel vegetal, fibra ótica de plástico e um híbrido orgânico-inorgânico. Estes objetos foram submetidos a um estímulo de luz coerente na região espectral visível e produziram um padrão de speckle o qual foi utilizado para recuperar a chave criptográfica associada a cada um dos materiais. A metodologia implementada neste trabalho incorpora a Transformada Discreta de Cosseno, o que possibilita a criação de um sistema criptográfico de 128 bits caracterizado por ser semi-compacto e de baixo custo. O protocolo de autenticação exigiu a análise de múltiplas respostas de diferentes Physically Unclonable Functions (PUFs), o que permitiu estabelecer um nível de limite de decisão ótimo de forma a maximizar a robustez e minimizar a probabilidade de erro por parte do sistema. O sistema de encriptação de 128 bits atingiu valores de probabilidade de erro abaixo do limite de deteção, 10-12, para todas as amostras, mostrando o seu potencial como gerador de chaves criptográficas.Mestrado em Engenharia Físic

Printed Electronics-Based Physically Unclonable Functions for Lightweight Security in the Internet of Things

Die moderne Gesellschaft strebt mehr denn je nach digitaler Konnektivität - überall und zu jeder Zeit - was zu Megatrends wie dem Internet der Dinge (Internet of Things, IoT) führt. Bereits heute kommunizieren und interagieren „Dinge“ autonom miteinander und werden in Netzwerken verwaltet. In Zukunft werden Menschen, Daten und Dinge miteinander verbunden sein, was auch als Internet von Allem (Internet of Everything, IoE) bezeichnet wird. Milliarden von Geräten werden in unserer täglichen Umgebung allgegenwärtig sein und über das Internet in Verbindung stehen. Als aufstrebende Technologie ist die gedruckte Elektronik (Printed Electronics, PE) ein Schlüsselelement für das IoE, indem sie neuartige Gerätetypen mit freien Formfaktoren, neuen Materialien auf einer Vielzahl von Substraten mit sich bringt, die flexibel, transparent und biologisch abbaubar sein können. Darüber hinaus ermöglicht PE neue Freiheitsgrade bei der Anpassbarkeit von Schaltkreisen sowie die kostengünstige und großflächige Herstellung am Einsatzort. Diese einzigartigen Eigenschaften von PE ergänzen herkömmliche Technologien auf Siliziumbasis. Additive Fertigungsprozesse ermöglichen die Realisierung von vielen zukunftsträchtigen Anwendungen wie intelligente Objekte, flexible Displays, Wearables im Gesundheitswesen, umweltfreundliche Elektronik, um einige zu nennen. Aus der Sicht des IoE ist die Integration und Verbindung von Milliarden heterogener Geräte und Systeme eine der größten zu lösenden Herausforderungen. Komplexe Hochleistungsgeräte interagieren mit hochspezialisierten, leichtgewichtigen elektronischen Geräten, wie z.B. Smartphones mit intelligenten Sensoren. Daten werden in der Regel kontinuierlich gemessen, gespeichert und mit benachbarten Geräten oder in der Cloud ausgetauscht. Dabei wirft die Fülle an gesammelten und verarbeiteten Daten Bedenken hinsichtlich des Datenschutzes und der Sicherheit auf. Herkömmliche kryptografische Operationen basieren typischerweise auf deterministischen Algorithmen, die eine hohe Schaltungs- und Systemkomplexität erfordern, was sie wiederum für viele leichtgewichtige Geräte ungeeignet macht. Es existieren viele Anwendungsbereiche, in denen keine komplexen kryptografischen Operationen erforderlich sind, wie z.B. bei der Geräteidentifikation und -authentifizierung. Dabei hängt das Sicherheitslevel hauptsächlich von der Qualität der Entropiequelle und der Vertrauenswürdigkeit der abgeleiteten Schlüssel ab. Statistische Eigenschaften wie die Einzigartigkeit (Uniqueness) der Schlüssel sind von großer Bedeutung, um einzelne Entitäten genau unterscheiden zu können. In den letzten Jahrzehnten hat die Hardware-intrinsische Sicherheit, insbesondere Physically Unclonable Functions (PUFs), eine große Strahlkraft hinsichtlich der Bereitstellung von Sicherheitsfunktionen für IoT-Geräte erlangt. PUFs verwenden ihre inhärenten Variationen, um gerätespezifische eindeutige Kennungen abzuleiten, die mit Fingerabdrücken in der Biometrie vergleichbar sind. Zu den größten Potenzialen dieser Technologie gehören die Verwendung einer echten Zufallsquelle, die Ableitung von Sicherheitsschlüsseln nach Bedarf sowie die inhärente Schlüsselspeicherung. In Kombination mit den einzigartigen Merkmalen der PE-Technologie werden neue Möglichkeiten eröffnet, um leichtgewichtige elektronische Geräte und Systeme abzusichern. Obwohl PE noch weit davon entfernt ist, so ausgereift und zuverlässig wie die Siliziumtechnologie zu sein, wird in dieser Arbeit gezeigt, dass PE-basierte PUFs vielversprechende Sicherheitsprimitiven für die Schlüsselgenerierung zur eindeutigen Geräteidentifikation im IoE sind. Dabei befasst sich diese Arbeit in erster Linie mit der Entwicklung, Untersuchung und Bewertung von PE-basierten PUFs, um Sicherheitsfunktionen für ressourcenbeschränkte gedruckte Geräte und Systeme bereitzustellen. Im ersten Beitrag dieser Arbeit stellen wir das skalierbare, auf gedruckter Elektronik basierende Differential Circuit PUF (DiffC-PUF) Design vor, um sichere Schlüssel für Sicherheitsanwendungen für ressourcenbeschränkte Geräte bereitzustellen. Die DiffC-PUF ist als hybride Systemarchitektur konzipiert, die siliziumbasierte und gedruckte Komponenten enthält. Es wird eine eingebettete PUF-Plattform entwickelt, um die Charakterisierung von siliziumbasierten und gedruckten PUF-Cores in großem Maßstab zu ermöglichen. Im zweiten Beitrag dieser Arbeit werden siliziumbasierte PUF-Cores auf Basis diskreter Komponenten hergestellt und statistische Tests unter realistischen Betriebsbedingungen durchgeführt. Eine umfassende experimentelle Analyse der PUF-Sicherheitsmetriken wird vorgestellt. Die Ergebnisse zeigen, dass die DiffC-PUF auf Siliziumbasis nahezu ideale Werte für die Uniqueness- und Reliability-Metriken aufweist. Darüber hinaus werden die Identifikationsfähigkeiten der DiffC-PUF untersucht, und es stellte sich heraus, dass zusätzliches Post-Processing die Identifizierbarkeit des Identifikationssystems weiter verbessern kann. Im dritten Beitrag dieser Arbeit wird zunächst ein Evaluierungsworkflow zur Simulation von DiffC-PUFs basierend auf gedruckter Elektronik vorgestellt, welche auch als Hybrid-PUFs bezeichnet werden. Hierbei wird eine Python-basierte Simulationsumgebung vorgestellt, welche es ermöglicht, die Eigenschaften und Variationen gedruckter PUF-Cores basierend auf Monte Carlo (MC) Simulationen zu untersuchen. Die Simulationsergebnisse zeigen, dass die Sicherheitsmetriken im besten Betriebspunkt nahezu ideal sind. Des Weiteren werden angefertigte PE-basierte PUF-Cores für statistische Tests unter verschiedenen Betriebsbedingungen, einschließlich Schwankungen der Umgebungstemperatur, der relativen Luftfeuchtigkeit und der Versorgungsspannung betrieben. Die experimentell bestimmten Resultate der Uniqueness-, Bit-Aliasing- und Uniformity-Metriken stimmen gut mit den Simulationsergebnissen überein. Der experimentell ermittelte durchschnittliche Reliability-Wert ist relativ niedrig, was durch die fehlende Passivierung und Einkapselung der gedruckten Transistoren erklärt werden kann. Die Untersuchung der Identifikationsfähigkeiten basierend auf den PUF-Responses zeigt, dass die Hybrid-PUF ohne zusätzliches Post-Processing nicht für kryptografische Anwendungen geeignet ist. Die Ergebnisse zeigen aber auch, dass sich die Hybrid-PUF zur Geräteidentifikation eignet. Der letzte Beitrag besteht darin, in die Perspektive eines Angreifers zu wechseln. Um die Sicherheitsfähigkeiten der Hybrid-PUF beurteilen zu können, wird eine umfassende Sicherheitsanalyse nach Art einer Kryptoanalyse durchgeführt. Die Analyse der Entropie der Hybrid-PUF zeigt, dass seine Anfälligkeit für Angriffe auf Modellbasis hauptsächlich von der eingesetzten Methode zur Generierung der PUF-Challenges abhängt. Darüber hinaus wird ein Angriffsmodell eingeführt, um die Leistung verschiedener mathematischer Klonangriffe auf der Grundlage von abgehörten Challenge-Response Pairs (CRPs) zu bewerten. Um die Hybrid-PUF zu klonen, wird ein Sortieralgorithmus eingeführt und mit häufig verwendeten Classifiers für überwachtes maschinelles Lernen (ML) verglichen, einschließlich logistischer Regression (LR), Random Forest (RF) sowie Multi-Layer Perceptron (MLP). Die Ergebnisse zeigen, dass die Hybrid-PUF anfällig für modellbasierte Angriffe ist. Der Sortieralgorithmus profitiert von kürzeren Trainingszeiten im Vergleich zu den ML-Algorithmen. Im Falle von fehlerhaft abgehörten CRPs übertreffen die ML-Algorithmen den Sortieralgorithmus