Modeling Attacks on Physical Unclonable Functions. Rührmair, U., Sehnke, F., Sölter, J., Dror, G., Devadas, S., & Schmidhuber, J. In Proceedings of the 17th ACM Conference on Computer and Communications Security, of CCS '10, pages 237–249, New York, NY, USA, 2010. ACM.
Modeling Attacks on Physical Unclonable Functions [link]Paper  doi  abstract   bibtex   
We show in this paper how several proposed Physical Unclonable Functions (PUFs) can be broken by numerical modeling attacks. Given a set of challenge-response pairs (CRPs) of a PUF, our attacks construct a computer algorithm which behaves indistinguishably from the original PUF on almost all CRPs. This algorithm can subsequently impersonate the PUF, and can be cloned and distributed arbitrarily. This breaks the security of essentially all applications and protocols that are based on the respective PUF. The PUFs we attacked successfully include standard Arbited PUFs and Ring Oscillator PUFs of arbitrary sizes, and XO Arbiter PUFs, Lightweight Secure PUFs, and Feed-Forward Arbiter PUFs of up to a given size and complexity. Our attacks are based upon various machine learning techniques including Logistic Regression and Evolution Strategies. Our work leads to new design requirements for secure electrical PUFs, and will be useful to PUF designers and attackers alike.
@inproceedings{ruhrmair_modeling_2010,
	address = {New York, NY, USA},
	series = {{CCS} '10},
	title = {Modeling {Attacks} on {Physical} {Unclonable} {Functions}},
	isbn = {978-1-4503-0245-6},
	url = {http://doi.acm.org/10.1145/1866307.1866335},
	doi = {10.1145/1866307.1866335},
	abstract = {We show in this paper how several proposed Physical Unclonable Functions (PUFs) can be broken by numerical modeling attacks. Given a set of challenge-response pairs (CRPs) of a PUF, our attacks construct a computer algorithm which behaves indistinguishably from the original PUF on almost all CRPs. This algorithm can subsequently impersonate the PUF, and can be cloned and distributed arbitrarily. This breaks the security of essentially all applications and protocols that are based on the respective PUF. The PUFs we attacked successfully include standard Arbited PUFs and Ring Oscillator PUFs of arbitrary sizes, and XO Arbiter PUFs, Lightweight Secure PUFs, and Feed-Forward Arbiter PUFs of up to a given size and complexity. Our attacks are based upon various machine learning techniques including Logistic Regression and Evolution Strategies. Our work leads to new design requirements for secure electrical PUFs, and will be useful to PUF designers and attackers alike.},
	urldate = {2015-06-12TZ},
	booktitle = {Proceedings of the 17th {ACM} {Conference} on {Computer} and {Communications} {Security}},
	publisher = {ACM},
	author = {Rührmair, Ulrich and Sehnke, Frank and Sölter, Jan and Dror, Gideon and Devadas, Srinivas and Schmidhuber, Jürgen},
	year = {2010},
	pages = {237--249}
}

Downloads: 0