VIETNAM NATIONAL UNIVERSITY, HANOI UNIVERSITY OF ENGINEERING AND TECHNOLOGY PHAM HOANG LONG IMPROVING IOT SECURITY USING PHYSICAL UNCLONABLE FUNCTION BACHELOR’S FINAL THESIS Major: Electronics and Communications Engineering Technology HA NOI - 2023 VIETNAM NATIONAL UNIVERSITY, HANOI UNIVERSITY OF ENGINEERING AND TECHNOLOGY PHAM HOANG LONG IMPROVING IOT SECURITY USING PHYSICAL UNCLONABLE FUNCTION BACHELOR’S FINAL THESIS Major: Electronics and Communications Engineering Technology Supervisor: Dr. Bui Duy Hieu Co-Supervisor: Dr. Tran Thi Thuy Quynh HA NOI - 2023 ABSTRACT With the popularity and rapid increase of IoT devices today, attacks on those devices are inevitable. In addition, IoT devices have limited power sources and low storage capacity, making them most vulnerable to attacks on hardware such as reverse engineering to discover the device’s structure and tamper with it.
This thesis presents a method to increase security for the Internet of Things system. IoT device often collects private data from the environment while they are often located in sensitive, less protected places without physical-level protection. As a consequence, they are vulnerable to various security threats and open new types of attacks. The proposed method integrates the Physical Unclonable Function (PUF) into the system in combination with other security countermeasures to enhance IoT device security.
PUFs can be used as a “fingerprint” for devices based on their near-impossible physical characteristics, thus providing a high level of security. This work uses PUF to enhance the authentication process and to generate security keys for each IoT device. This thesis also analyzes the effectiveness of the proposed method by evaluating and analyzing the quality of PUF based on the criteria of uniqueness, reliability, energy consumption, usable area and ease of integration after being implemented and integrated on the Arty A7 100T FPGA Development Board. The PUF IP was successfully integrated into an IoT sensor node controlled by a 32-bit RISC-V core.
The system needs 22016 LUTs, 18 LUTRAMs, 125533 FFs, 16 BRAMs, 8 DSPs, 69 IOs and 1 MMCM. Key words: FPGA, Physical Unclonable Function, Internet of Things, IoT security 1 ACKNOWLEDGEMENT Firstly, I would like to express my sincere gratitude to Dr. Bui Duy Hieu and Dr. Tran Thi Thuy Quynh - who has encouraged, guided and instructed me wholeheartedly while conducting my research.
The knowledge shared is a valuable asset that helps me take a step forward on my career path. With the deepest appreciation, I would like to extend my thanks to the teachers in the Faculty of Electronics and Telecommunications in particular and at the University of Technology - Vietnam National University, Hanoi in general, who have enthusiastically imparted their valuable knowledge to us with all their passion and expertise during our time at the university. I would like to thank Professors and fellow PhD students at the Institute of Information Technology- Vietnam National University, Hanoi, who have helped me and given me the most sincere advice throughout my research and completing my thesis. Finally, I would like to express my gratitude to my family, who have always supported, trusted, cared for me and been a strong spiritual support for me.
Although I have tried my best to complete my thesis with all my enthusiasm and effort, there may be some shortcomings. I sincerely hope to receive valuable feedback from the professors and my peers. Ha Noi, 05/05/2023 Student Pham Hoang Long 2 AUTHORSHIP I hereby declare that the thesis “Improving IoT security using Physical Unclonable Function ” is my own research work under the guidance of Dr. Bui Duy Hieu and Dr.
Tran Thi Thuy Quynh. All references from relevant studies are clearly cited in the thesis’s bibliography. In this thesis, there is no copying of other people’s documents or research without specifying the references. Ha Noi, 05/05/2023 Student Pham Hoang Long 3 CONTENTS ABSTRACT.
4 List of Figures. 6 List of Tables. 7 List of Acronyms/Abbreviation. OVERVIEW OF IOT AND ITS SECURITY PROBLEMS.
Security Threats and Attacks in the IoT System. Physical Unclonable Function (PUF). Device identification and secure authentication. PROPOSED HARDWARE ARCHITECTURE.
Proposed hardware architecture .2 PUF IP architecture. HARDWARE IMPLEMENTATION RESULTS AND APUF EVALUATIONS. Hardware implementation on FPGA. 32 FPGA design and implementation flow.
APUF Test and Evaluation on Arty A7 100T development kit. Embedded software running on RISC-V core for APUF evaluation. Response captured from APUF. Evaluating the responses and the enrollment process.
49 CONCLUSIONS AND FUTURE WORKS. 51 5 List of Figures Figure 1. Challenge and Response pair. Different PUF with same Challenge produce different Response.
Ring Oscillator PUF architecture [12]. Arbiter PUF architecture [13]. PUF-based Authentication [15]. Hardware architecture of IoT system using APUF.
n-stage Arbiter PUF with challenge c [19]. APUF IP Diagram. Arbiter PUF architecture. Arbiter PUF memory map.
Mutual authentication for IoT device and server. Arty A7-100T Development Board. PUF implement flow on FPGA. APUF IP after implemented on FPGA with physical constraints.
Delay elements implemented as a single LUT primitive on Xilinx Artix-7 FPGA. FPGA board resource usage result after hardware execution. Percentage of hardware resources of Arty A7 100T FPGA board used. Hardware execution results of the system on chip using the platform.
Power analysis from implemented netlist. Distribution of interchip Hamming Distance of PUF response on 2 different (position of delay elements) constraints in same FPGA. Scale of bit 0 in response. Selected bias range of response.
Percentage of bit 0 and bit 1 in each position in selected response set. 47 6 List of Tables Table 2. Notation in protocol. Describe the connection pins of Arty A7-100T: Development Board.
46 7 List of Acronyms/Abbreviation AES Advanced Encryption Standard AMS Analog Mixed Signal AppSkey Application Session Key APUF Arbiter Physical Unclonable Function AXI Advanced eXtensible Interface BRAM Block RAM BUFG Global Buffer CRP Challenge Response Pair DES Data Encryption Standard DSP Digital Signal Processing FF Flip Flop FPGA Field Programmable Gate Array FSM Finite State Machine HD Hamming Distance I/O Input/Output IC Integrated Circuit ID Identification IoT Internet of Things IP Intellectual Property LUT Look-Up Table LUTRAM Look-Up Table RAM MAC Message Authentication Code MIC Message Integrity Code MMCM Mixed-Mode Clock Manager MUX Multiplexer 8 NIST US National Institute of Standards and Technology NVM Non-volatile Memory NwkSkey Network Session Key PUF Physical Unclonable Function PULP Parallel Ultra Low Power RAM Random Access Memory RFID Radio Frequency Identification RISC Reduced Instruction Set Computer ROPUF Ring Oscillator Physical Unclonable Function RTL Register Transfer Level SoC System on Chip SPI Serial Peripheral Interface UART Universal Asynchronous Receiver/Transmitter VHDL VHSIC Hardware Description Language VHSIC Very High Speed Integrated Circuit XDC Xilinx Design Constraint 9 INTRODUCTION The Internet of Things (IoT) has revolutionized the way we live and work, connecting devices, systems, and people to create intelligent environments that can automate tasks, monitor resources, and increase quality. However, the rapid growth of IoT also increases the risks related to security and privacy, as more and more devices are connected to the network and are possibly vulnerable to many attacks. IoT devices are particularly vulnerable due to limited processing power, memory, and battery life. IoT systems often use lightweight cryptographic primitives in the design to reduce computation complexity, power consumption and memory footprints to build authentication protocols and data encryption.
Therefore, most encryption methods rely on symmetric key encryption, which uses the root keys stored in the device's flash memory [1]. Besides, IoT devices are often placed in sensitive, less protected places such as the outdoors, in forests, etc. However, they collect private data from the surrounding environment. As a result, these devices are the weakest link in IoT systems, hence targeted by attackers.
When attackers steal the device, they can perform Reverse Engineering, from which they can get the device's encryption key, leading to re-spoofing that device and infiltrating the system. IoT devices are considered resource-constrained devices that can’t provide high-security methods to resist these attacks. Physical Unclonable Function can act as a device’s “digital fingerprint”, which could be a solution to these problems. This thesis shows how a PUF can be used to eliminate key storage in the IoT sensor nodes.
PUFs employ the non-uniformity of integrated circuit (IC) manufacturing, which introduces random physical variation into the microstructure of the IC to make it unique. PUFs are essential to provide non-replicable unidirectional functions. Furthermore, it gives PUFs an advantage in enhancing the security of constrained devices such as IoT sensor nodes. One of the key requirements of IoT systems is authentication.
A device can verify that the data received is from another trusted device. Therefore, authentication is the first step to be taken care of when starting an IoT device. However, this step needs to be done efficiently without affecting the data in the system. Therefore, this thesis also proposes a lightweight authentication protocol for IoT systems based on PUFs.
The proposed protocol achieves the desired security performance requirements by integrating PUF into an IoT sensor node and implementing it on FPGA. 10 The main contributions of this thesis are the integration of PUFs into an RISC-V - based IoT system using PULPino platform and the implementation of an authentication protocol using PUF with low power consumption, low resource usage, and secure protocol against physical attacks. The thesis is divided into four chapters as follows: Chapter 1 presents an overview of IoT and system physical threats. It also analyzes the advantages of using PUF over other methods and discusses the type of PUF used in this thesis.
Chapter 2 shows the proposed PUF architecture to be integrated into the IoT sensor node and the authentication protocol. Chapter 3 discusses the hardware implementation results on FPGA and evaluates the performance of the proposed system. Finally, there are some conclusions and future works. OVERVIEW OF IOT AND ITS SECURITY PROBLEMS This chapter focuses on analyzing the security issues of IoT systems and introduces Physical Unclonable Function (PUF) and how PUF can enhance the security for IoT systems.
It also discusses the related works on PUF-based security in IoT systems. From there, a suitable PUF architecture for IoT sensor nodes will be proposed. Security Threats and Attacks in the IoT System Wireless communication technology has become integral to our daily lives through IoT applications. IoT allows billions of “Things” to connect to create utilities for people.
IoT systems now have different impacts on people’s daily lives. They can be devices that are always with us, like RFID tags, smart home systems or data collection systems from the environment. But those systems all have one thing in common, the exchange of information. Sometimes, they are private and must be kept secret from the outside world.
However, to reduce manufacturing cost and power consumption, IoT devices are often constrained with limited processing power and memory footprints, making them a target for hackers to break the overall system and steal information. Therefore, one of the big challenges in the IoT field is the security of those systems. IoT sensor nodes are embedded systems with the following properties. First, they are designed for a specific task and have just enough processing power and memory to perform that task [2].
Second, IoT devices are considered “headless” because they operate fully automatically [3]. Finally, the majority of IoT devices do not have large power sources, they must rely on limited energy sources such as batteries or harvesting from the environment such as wind power, solar energy and so on [2]. Besides, they are often located in sensitive locations such as in parks, in gardens, in forests, etc. These locations are physically unprotected which enable attackers to easily steal those devices.
Because of the limited processing power, memory and battery life of IoT devices, they are often equipped with lightweight security methods. The most typical is using the symmetric cryptography with the secrete key pre-shared to initiate the authentication and authorization for the communication.