Search

CN-122001584-A - Machine learning attack resistant circuit of PUF

CN122001584ACN 122001584 ACN122001584 ACN 122001584ACN-122001584-A

Abstract

The invention provides a machine learning attack resistant circuit of a PUF, which belongs to the field of PUFs and comprises two SAC-PUF circuits, wherein each SAC-PUF circuit comprises an arbiter D 1 and n path switch switches, n control ends of the n path switch switches are respectively connected with values of n triggers, output ends of j and k path switch switches are respectively connected with an output end of the arbiter D 3 、D 2 ,D 1 、D 2 、D 3 and are connected with an confusion circuit, an output end of the confusion circuit in the first SAC-PUF circuit is respectively connected with a first control end of a tap unit and a first input end of a post-processing circuit, an output end of the confusion circuit in the second SAC-PUF circuit is respectively connected with a second control end of the tap unit and a second input end of the post-processing circuit, an output end of the post-processing circuit is connected with a second input end of each tap unit, and a first input end of each tap unit is connected with a value of the n trigger, and the machine learning attack resistant capability is improved.

Inventors

  • LIANG HUAGUO
  • CHEN JINLIN
  • LU YINGCHUN

Assignees

  • 合肥工业大学

Dates

Publication Date
20260508
Application Date
20260409

Claims (10)

  1. A machine learning attack resisting circuit of a PUF is characterized by comprising two symmetrical SAC-PUF circuits, wherein each SAC-PUF circuit comprises an arbiter D 1 and n path exchange switches, n is an integer larger than 0, n control ends of the n path exchange switches are respectively connected with values of n triggers, output ends of the j-th and k-th path exchange switches are respectively connected to the arbiter D 3 、D 2 , 0≤j < n-1, 0≤k < n-1, j & ltoreq.k, the output end of the arbiter D 1 、D 2 、D 3 is connected to an confusion circuit, the output end of the confusion circuit in the first SAC-PUF circuit is respectively connected with a first control end of a tap unit and a first input end of a post-processing circuit, the output end of the confusion circuit in the second SAC-PUF circuit is respectively connected with a second control end of the tap unit and a second input end of the post-processing circuit, the output end of the post-processing circuit is connected with the second input end of each tap unit, the first input end of each tap unit is connected with the value of the n-th trigger, and the output end of the tap unit is connected with the input end of a logic gate of the logic gate of n < i.
  2. 2. The machine learning attack resisting circuit of claim 1, wherein the tap unit comprises an exclusive OR gate and two-input MUXs, the control ends of the first two-input MUXs and the second two-input MUXs are respectively used as a first control end and a second control end of the tap unit, the input ends of the two-input MUXs are configured to obtain a first input end and a second input end of the tap unit, the output ends of the two-input MUXs are respectively connected to the exclusive OR gate, and the output end of the exclusive OR gate is used as the output end of the tap unit.
  3. 3. The PUF machine learning attack resistant circuit of claim 2 wherein the outputs of the three tap cells are connected to the input of the i 1 、i 2 、i 3 th flip-flop through exclusive or gates, 0<i 1 <n,0<i 2 <n,0<i 3 <n,i 1 ≠i 2 ≠i 3 , respectively, the first and second inputs of the first two-input MUX being connected to and acting as the first input of the tap cell, and the first and second inputs of the second two-input MUX being connected to and acting as the second input of the tap cell.
  4. 4. The machine learning attack resisting circuit according to claim 2, wherein the three tap units are a first tap unit, a second tap unit and a third tap unit, the output ends of the first, second and third tap units are respectively connected to the input end of the i 1 、i 2 、i 3 flip-flops through exclusive-OR gates, 0<i 1 <n,0<i 2 <n,0<i 3 <n,i 1 ≠i 2 ≠i 3 , the second input end of the first two-input MUX is connected to the second input end of the second two-input MUX and serves as the first input end of the tap unit, the first input end of the first two-input MUX is connected to the first input end of the second two-input MUX and serves as the second input end of the tap unit, the first input end of the first two-input MUX is connected to the first input end of the second two-input MUX and serves as the first input end of the tap unit, and the first input end of the second two-input MUX is connected to the second input end of the tap unit and serves as the second input end of the tap unit.
  5. 5. The machine learning attack resistant circuit of claim 3 or 4, wherein n is 64,64 flip-flops are connected end to end, i 1 、i 2 、i 3 is 16, 32, 48, j is 28, and k is 43, respectively.
  6. 6. The machine learning attack resistant circuit of claim 1 wherein the result of the exclusive or of the output values of the garbled circuits in the two SAC-PUF circuits is taken as the input to the multiplexers, the historical output values of the post-processing circuits are fed back to the selection ports of the multiplexers, and the current output values of the post-processing circuits are obtained after the exclusive or of the outputs of the two multiplexers.
  7. 7. The machine learning attack resistant circuit of claim 6 wherein the output value A of the garbled circuit in the first SAC-PUF circuit and the output value B of the garbled circuit in the second SAC-PUF circuit are 0 and 0 respectively, and the historical output value R pre of the post-processing circuit is 0 when the current output value R after of the post-processing circuit is 0;A =0, B=0, R pre =1 when R after =0;A=0,B=1,R pre =0, R after =1;A=0,B=1,R pre =1, R after =0;A=1,B=0,R pre =0, R after =0;A=1,B=0,R pre =1, R after =1;A=1,B=1,R pre =0, R after =1;A=1,B=1,R pre =1, R after =1.
  8. 8. The machine learning attack resisting circuit according to claim 1, wherein the post-processing circuit comprises a first exclusive-or gate, a second exclusive-or gate, a third two-input MUX and a fourth two-input MUX, wherein the output end of the confusion circuit in the first SAC-PUF circuit is respectively connected to the first input end of the first exclusive-or gate and the first input end of the third two-input MUX, the output end of the confusion circuit in the second SAC-PUF circuit is respectively connected to the second input end of the first exclusive-or gate and the second input end of the fourth two-input MUX, the output end of the first exclusive-or gate is respectively connected to the second input end of the third two-input MUX and the first input end of the fourth two-input MUX, and the output end of the third two-input MUX is respectively connected to the first input end of the second exclusive-or gate and the second input end of the fourth two-input MUX.
  9. 9. The machine learning attack resistant circuit of claim 1 wherein when the output X, Y, Z of the arbiter D 1 、D 2 、D 3 is 0, respectively, when the output Out of the garbled circuit is 0;X =0, y=0, z=1, out= 0;X =0, y=1, z=0, out= 1;X =0, y=1, z=1, out= 0;X =1, y=0, z=0, out= 1;X =1, y=0, z=1, out= 0;X =1, y=1, z=0, out= 1;X =1, y=1, z=1, out=1.
  10. 10. The machine learning attack resisting circuit according to claim 1, wherein the garbling circuit comprises a first buffer, a second buffer, an inverter, a first AND gate, a second AND gate, a third AND gate and an OR gate, wherein the output end of the arbiter D 1 、D 2 is connected to the input ends of the first buffer and the second buffer, the output end of the arbiter D 3 is connected to the input end of the inverter, the output end of the first buffer is connected to the first input ends of the first AND gate and the second AND gate, the output end of the second buffer is connected to the second input ends of the second AND gate and the third AND gate, the output end of the inverter is connected to the second input end of the first AND gate and the first input end of the third AND gate, the output ends of the first AND gate, the second AND gate and the third AND gate are connected to the input end of the OR gate, and the output end of the OR gate is used as the output end of the garbling circuit.

Description

Machine learning attack resistant circuit of PUF Technical Field The invention relates to the technical field of physical unclonable functions (Physical Unclonable Function, PUFs), in particular to a machine learning resistant circuit of a PUF. Background The hardware security technology based on the physical unclonable function is widely applied to the fields of Internet of things equipment, identity authentication, key generation and the like due to the unique physical randomness, unclonability and high efficiency. PUFs provide a lightweight solution for hardware security by extracting microscopic physical differences inherent in the chip manufacturing process (e.g., random fluctuations in transistor threshold voltages) to generate unpredictable response signals. However, machine learning attacks (MACHINE LEARNING ATTACK, MLA) against PUFs have become a significant threat in recent years. The MLA trains a machine learning model by collecting Challenge-Response Pair (CRP) of the PUF to predict its Response behavior, thereby destroying unpredictability and security of the PUF. For example, research on arbiter PUFs or ring oscillator PUFs shows that algorithms such as linear regression, neural networks and the like can realize high-precision modeling under limited CRP samples, and seriously threaten actual deployment of PUFs. In the process of improving the machine learning attack resistance of the PUF, quantitative evaluation of the security of the PUF is a core task. The method can not only verify the effectiveness of the existing protection technology, but also identify the fragile link of the PUF design, and provide basis for targeted reinforcement and optimization. At present, main methods for evaluating the resistance of PUFs to machine learning attacks are divided into two types (1) an actual modeling attack experimental method, namely, an attack model is directly trained and the success rate is statistically predicted by actually collecting a CRP data set of a target PUF. The method can truly reflect the defending capability of the PUF, but needs to take a large amount of time to collect massive CRP data, and the experimental process may introduce deviation due to physical aging of the PUF or environmental noise. (2) The attack method is simulated by modeling the physical properties of the PUF (e.g. delay profile, nonlinear noise) mathematically and generating CRPs based on the simulated data to train an attack model. Compared with the actual experiment, the simulation method has the advantages of strong controllability, low cost and quick iteration, but the accuracy of the simulation method is highly dependent on the fitting degree of the model to the actual physical characteristics, and the actual attack difficulty can be underestimated. As an important means for evaluating PUF security, actual modeling attack is required to collect stimulus responses of PUF circuits, and by means of existing machine learning attack, resource overhead and machine learning attack problems need to be considered. The existing various strong PUF circuits have good machine learning resistance, but still face the problem of high resource expenditure. As in paper "A Lightweight Authentication Protocol Against Modeling Attacks Based on a Novel LFSR-APUF"（Wang,Yao et al, zhengzhou University, IEEE INTERNET OF THINGSJOURNAL, VOL.18, NO., SEPTEMBER 2020) uses 388 LUTs and 399 DFFs, and although achieving better modeling resistance, the use OF resources is larger, and is difficult to adapt to lightweight application scenarios. Similarly, another research designs a dynamic attack framework based on a gradient lifting tree, and the modeling efficiency is improved through self-adaptive feature selection, but the resource consumed by the self-adaptive selection module and the obtained performance improvement may have a further balanced space. And then, as the Chinese patent application CN113922990A discloses a strong PUF machine learning attack resisting method based on matrix encryption, a plurality of groups of response signals generated by different excitation signals acting on the strong PUF are used as information to be encrypted, the response signals are arranged to form a plaintext matrix, encryption operation is carried out, two plaintext matrices are used for generating a ciphertext matrix through matrix multiplication operation, elements in a conversion matrix obtained after binary conversion is used as final response, the elements are in one-to-one correspondence with the original excitation signals and are used as final CRP of the matrix encryption strong PUF. Therefore, the existing PUF circuit for resisting the machine learning attack has the problems of resource overhead and difficulty in balancing the improvement of the resistance to the machine learning, and therefore, a PUF circuit design scheme for resisting the machine learning attack, which supports a lightweight scene and has enough machine learning resistanc