![](bg5.png)
that while various PUFs are highly limited in their
role as primary security element in a given system,
they still may play an ideal role as a component in
more comprehensive symbiotic security design, such
that no one PUF feature is overly emphasised, yet
each is utilised by its strength. We identify current
challenges surrounding modern PUF design, and de-
termine how each could be mitigated/exploited by
symbiotic security design.
,→ Observation 2.2.1. A PUF would ideally be en-
tirely reliable, where environmental conditions do not
affect the PUF to output the exact same output for
every measurement. With the primary means of en-
tropy deriving from sub-atomic variations in the PUF
material, noise is an inevitable feature that must be
dealt with to reduce measurement instabilities.
,→ Challenge 2.2.1. Commonly, issues regarding
PUF reliability are tackled with various forms of er-
ror correction as an accepted resource overhead, yet
it has been shown that publicly known helper data
required for error correction can provide adversaries
with sufficient information to successfully comprom-
ise the security of PUFs (Delvaux and Verbauwhede,
2014), (Strieder et al., 2021). It is well known that
environmental conditions, most notably temperature,
have dominant effect on the physical characteristics,
such as, e.g., the clock skew of a processor. If one
learns and knows this dependency, it is possible to
filter it out and determine a stable value which can
enable identification. A sensor, however, is required
to measure a given environmental condition which re-
quires additional equipment and is often unfeasible in
the targeted scenarios. A method which does not re-
quire explicit knowledge of the environmental condi-
tion would solve this problem. This introduces new
concerns on how best to manage the noisy nature of
PUFs given a sufficiently strong (and very reasonable)
threat model.
,→ Strategy 2.2.1. Common or comparable AI-
assisted techniques can help overcome environmental
variance issues in PUFs to improve reliability with re-
gard to the resulting entropy (Wen and Lao, 2017).
In addition, environmental effects on physical sys-
tems – hence what originally causes a reliability prob-
lem – can be exploited as a benefit, enabling anom-
aly/intrusion detection and device identification based
on known individual behaviours in various operat-
ing conditions, provided training processes can be
offloaded to server computation within the scheme.
Therefore in essence, environmental effects on hard-
ware characteristics can be eliminated by consider-
ing their dependency and adjusting the correspond-
ing characteristic value based on the sensed condi-
tion. Since such sensors are not present in most off-
the-shelf devices, we propose a strategy which elim-
inates such dependencies without explicit knowledge
of the sensor value. The idea is to learn legitimate
combinations of hardware characteristics under dif-
ferent conditions (reflected by measurements at dif-
ferent times). This can be done by considering several
devices at the same time, or alternatively, using dif-
ferent, statistically independent, physical parts of one
device (e.g., part of a PUF). The practicability of this
idea was demonstrated by Lanze et al (Lanze et al.,
2014), where the effect of temperature variations on
clock skew enable physical device fingerprinting for
identification of wireless access points. In that work,
the authors applied one-class SVM to learn legitimate
combinations of devices at a particular location. ■
,→ Observation 2.2.2. Arguably the most import-
ant feature to be provided by a PUF is unpredictabil-
ity/unclonability, such that it is impossible for an ad-
versary to generate a ‘copy’ of the target which ex-
hibits identical behaviour. Failure to ensure this com-
promises PUF secrets, enabling an adversary to im-
personate devices or decrypt collected encrypted net-
work traffic. PUFs are popularly proposed in a lim-
ited variety of use cases, such as for authentication
token generation or repeatable key storage. For gen-
erating unique authentication tokens, a Strong PUF is
required (strong not indicating the security properties
of the PUF, rather its ability to generate unique tokens
exponentially with PUF size), where each token is
discarded after use to prevent replay attacks.
,→ Challenge 2.2.2. Novel Strong PUF designs
are commonly proven to be insecure against Ma-
chine Learning Modelling Attacks (ML-MA), creat-
ing rightful skepticism on whether a truly attack res-
istant Strong PUF implementation is possible given
enough data (Rührmair et al., 2010). Once the PUF
is compromised in common PUF-based security pro-
tocols, the entire scheme is compromised, leaving de-
signers with little room to enhance threat models suf-
ficiently for a realistic IoT threat environment.
,→ Strategy 2.2.2. We argue that the PUF entropy
may be exploited as a single hardware entropy unit to
be integrated tightly with – not on top of – a coincid-
ing software-based entropy solution. Such integration
creates a dependency between both sources, relieving
some pressure for per-bit unpredictability as adversar-
ies should be required to simultaneously model the
software entropy, hardware entropy, and the depend-
ency between both. ■
,→ Observation 2.2.3. The superposition of physical
hardware component fingerprints can be used to as-
sess the integrity of the system.
Design Rationale for Symbiotically Secure Key Management Systems in IoT and Beyond
587