RF-PUF: Enhancing IoT Security through Authentication of Wireless Nodes using In-situ Machine Learning

Baibhab Chatterjee; Debayan Das; Shovan Maity; Shreyas Sen

Source-linked AI summary

RF-PUF: Enhancing IoT Security through Authentication of Wireless Nodes using In-situ Machine Learning

Baibhab Chatterjee, Debayan Das, Shovan Maity, Shreyas Sen

arXiv:1805.01374v3May 3, 2018cs.CRcs.AIcs.NEeess.SP

TL;DR

Existing RF and IoT authentication methods can expose secret identifiers or keys to attacks, motivating alternatives based on physical device variation. RF-PUF authenticates wireless transmitters by learning their inherent RF signatures at the receiver without added transmitter circuitry. Simulations report 99.9% accuracy for up to 4800 transmitters and about 99% for 10,000 transmitters under varying channel conditions.

Problem
Traditional RF and IoT authentication schemes based on keys or OAuth can be vulnerable to attacks that copy or model secret identifiers and encryption keys.
Method
RF-PUF uses transmitter manufacturing-dependent RF properties as PUF entropy and applies in-situ machine learning at the receiver without additional transmitter hardware.
Results
99.9% accuracy is reported for up to 4800 transmitters, and about 99% accuracy for 10,000 transmitters under varying channel conditions.
Takeaways & Limitations
RF-PUF provides a low-cost authentication approach for asymmetric IoT networks without preamble-based or key-based transmitter identification.
Takeaways & Limitations
Replay attacks are theoretically possible because transmitters can repeatedly send identical digital data streams, so PUF reuse cannot be avoided.

Abstract

from arXiv · show

Traditional authentication in radio-frequency (RF) systems enable secure data communication within a network through techniques such as digital signatures and hash-based message authentication codes (HMAC), which suffer from key recovery attacks. State-of-the-art IoT networks such as Nest also use Open Authentication (OAuth 2.0) protocols that are vulnerable to cross-site-recovery forgery (CSRF), which shows that these techniques may not prevent an adversary from copying or modeling the secret IDs or encryption keys using invasive, side channel, learning or software attacks. Physical unclonable functions (PUF), on the other hand, can exploit manufacturing process variations to uniquely identify silicon chips which makes a PUF-based system extremely robust and secure at low cost, as it is practically impossible to replicate the same silicon characteristics across dies. Taking inspiration from human communication, which utilizes inherent variations in the voice signatures to identify a certain speaker, we present RF- PUF: a deep neural network-based framework that allows real-time authentication of wireless nodes, using the effects of inherent process variation on RF properties of the wireless transmitters (Tx), detected through in-situ machine learning at the receiver (Rx) end. The proposed method utilizes the already-existing asymmetric RF communication framework and does not require any additional circuitry for PUF generation or feature extraction. Simulation results involving the process variations in a standard 65 nm technology node, and features such as LO offset and I-Q imbalance detected with a neural network having 50 neurons in the hidden layer indicate that the framework can distinguish up to 4800 transmitters with an accuracy of 99.9% (~ 99% for 10,000 transmitters) under varying channel conditions, and without the need for traditional preambles.

I. INTRODUCTION

RF-PUF uses inherent transmitter RF variations as device-specific identities, with receiver-side machine learning performing authentication in asymmetric IoT networks without added transmitter hardware.

A. Background and Motivation: RF-PUF exploits manufacturing-dependent RF impairments in transmitters as entropy for strong-PUF-based node identification.Examples include frequency error or offset and I-Q imbalance, which are normally treated as unwanted non-idealities.
B. Our Contribution: RF-PUF is intended for authentication and related applications including intrusion detection, forensic data collection, defect monitoring, and body-connected biosensors.The method can operate as a standalone physical-layer feature or alongside higher-layer security mechanisms.
B. Our Contribution: The asymmetric architecture uses multiple low-cost distributed transmitters and one central receiver that performs the computationally intensive authentication.The receiver-side design parallels listener-based recognition of a speaker’s inherent voice signature.
B. Our Contribution: RF-PUF requires no additional on-chip or off-chip PUF circuitry at resource-constrained IoT transmitters.It reuses process variability and component tolerance already present in each transmitter.
B. Our Contribution: A lightweight machine-learning framework compensates for receiver non-idealities while accounting for data and channel variability.The framework uses an ANN for the resulting nonlinear multidimensional classification problem.

II. RELATED WORK

RF-PUF combines PUF concepts with RF fingerprinting in a preamble-less, steady-state architecture that uses receiver-side machine learning and avoids extra transmitter hardware.

II. RELATED WORK: Prior silicon PUFs measured intrinsic circuit delays, while robustness requirements introduced system-level error-correction mechanisms and added implementation burden.The related work frames RF-PUF against silicon PUF designs that trade reliability improvements for additional software or hardware.
II. RELATED WORK: Traditional RF fingerprinting identifies wireless nodes from time- and frequency-domain properties, but transient methods require reliable transient boundaries and high receiver oversampling.The cited examples use oversampling rates of 500 MS/s and 50 GS/s.
II. RELATED WORK: RF-PUF trains an in-situ receiver-side learning subsystem on multiple data conditions using steady-state signals without a traditional preamble.The approach combines PUF-based manufacturing variability with RF fingerprinting for device identification.
II. RELATED WORK: Compared with RF fingerprinting, RF-PUF uses higher-dimensional features, compensates for receiver signatures, and does not require high oversampling or extra transmitter RF hardware.These design choices support its stated strong-PUF properties and larger device or challenge-response-pair capacity.

III. PROPOSED PUF

RF-PUF uses manufacturing variability in wireless transmitters as device-specific signatures, extracted from received signals and learned at the receiver under channel variation.

Manufacturing variation across low-cost IoT nodes creates device-specific RF differences that can support authentication.The approach embraces node-to-node variation rather than tightly controlling fabrication.
The receiver identifies each transmitter by extracting multiple features from received signals.The PUF properties originate in the transmitters, while identification occurs in the receiver subsystem.
RF-PUF uses an asymmetric transmitter-receiver simulation setup in which transmitter variability is analyzed at the receiver.The supplied passages identify the setup and its receiver-side feature-processing role.
Features utilized in RF-PUF implementation: Frequency offset, I-Q mismatch, PA back-off, and gain variation provide transmitter-side features for identification.I-Q imbalance distorts the 16-QAM constellation, while PA nonlinearity affects outer symbols more strongly than inner symbols.
Features utilized in RF-PUF implementation: Channel attenuation, distortion, and Doppler shift are estimated and compensated using AGC, RRC filtering, and Doppler correction.These channel features are supplied to the ANN to support reliable RF-PUF operation.

B. Communication System Example in RF-PUF: 16-QAM

RF-PUF maps digital challenges transmitted through 16-QAM radios to unique analog RF responses and evaluates them at the receiver for identification and authentication.

Communication System Example in RF-PUF: 16-QAM: A 3-layer ANN receives extracted RF features and identifies transmitters from training data.The transmitter requires no additional PUF circuitry, while receiver processing performs feature extraction.
Communication System Example in RF-PUF: 16-QAM: Manufacturing itself serves as the creation procedure for RF-PUF instances.Each RF transmitter is treated as a PUF instance created through fabrication variability.
Communication System Example in RF-PUF: 16-QAM: D_intra measures variation between evaluations of one PUF under changing conditions and therefore captures reproducibility.An ideal reproducible system has D_intra = 0%.
Communication System Example in RF-PUF: 16-QAM: RF-PUF exhibits reproducibility, uniqueness, and identifiability, with worst-case D_inter of 3.9 ppm exceeding D_intra of 2.9 ppm for 1000 transmitters.These results are reported as geometric means of ppm variations over all features.
Communication System Example in RF-PUF: 16-QAM: The RF-PUF challenge is a digital bit-stream, while each transmitter produces a unique analog response embedded in the transmitted RF signal.This analog response defines the challenge-response behavior used for device differentiation.
Communication System Example in RF-PUF: 16-QAM: Preamble-less RF-PUF operation allows authentication without requiring the expected transmitted bit-stream.The framework is presented as a low-cost intrinsic authentication approach for asymmetric IoT networks.

D. Training the ANN for Device Identification

The ANN is trained iteratively on varying bit-streams and channel conditions so it can identify devices without relying on fixed preambles.

Training the ANN for Device Identification: The 3-layer ANN uses multiple training iterations with different pseudo-random bit-streams to support data variability and preamble-less operation.Hyperparameters were optimized using scaled conjugate gradient backpropagation.
Training the ANN for Device Identification: Each training iteration uses different bit-streams and channel conditions, enabling the network to learn variability across evaluations.The figure caption explicitly links iterations to changing data and channel conditions.

IV. PERFORMANCE METRICS

The simulation models transmitter and channel variability for 16-QAM RF-PUF evaluation using 65 nm process variation and 10,000 devices.

PERFORMANCE METRICS: 10,000 PUF devices were simulated under varying channel conditions using a standard 65 nm technology model.Process variation was modeled over the range μ ± 3σ.
PERFORMANCE METRICS: The simulation uses transmitter features and channel features, including LO frequency behavior, I-Q imbalance, PA linearity, and E_b/N_0.E_b/N_0 defines the receiver signal-to-noise ratio.

A. Probability of False Detection

RF-PUF’s false-detection probability decreases with sufficient neural-network capacity and variable-data training, supporting identification across thousands of transmitters.

< 10^-3 false-detection probability is achieved up to 4800 transmitters, while < 10^-2 is achieved for 10,000 transmitters.
Training with variable data over multiple iterations approaches the performance of fixed-preamble training.Each iteration uses a different channel condition, allowing the network to learn channel compensation.

B. Robustness to Noise, Dynamic Channel Variation and ISI

RF-PUF remains robust under channel impairments when receiver filtering improves feature extraction, while its uniqueness margin narrows as the transmitter population grows.

10^-5 probability of error is reached with an RRC filter across the shown channel-attenuation variations.Without the filter, increased inter-symbol interference produces an error probability of approximately 0.02 at 10 dB standard deviation and 15 dB mean E_b/N_0.
The channel is affected by noise, attenuation, interference, Doppler shift, and fading, with attenuation identified as the dominant contribution.
The RF-PUF output exceeds 0.9 pass rates on all 15 NIST tests and exceeds 0.95 on the Frequency test.

E. Experimental Validation of RF-PUF: Physical

Experimental validation uses software-defined radios to capture transmitter non-idealities and evaluates receiver-signature compensation for practical device identification.

2.4 GHz SDRs exhibit a measured frequency difference of 23 kHz, while amplitude and phase imbalance are captured after reception.
Practical compensation must address temperature and supply-voltage variation before ANN classification.The paper identifies sensing and preprocessing, or direct neural-network learning of these variations, as implementation options or future work.
Up to 10,000 transmitters are supported with < 10^-2 false-detection probability, and up to 4800 with < 10^-3.
Receiver signatures can be compensated by a second neural network before the original ANN performs device identification.

B. Possible Attack Models

The paper considers replay and machine-learning modeling attacks, describing replay as theoretically possible but costly and modeling as constrained by available challenge-response pairs.

Replay attack model: Replay succeeds only if the attacker accurately compensates both receiver and transmitter signatures: ARS=ARS* and ATS=ATS*.The required high-speed, high-resolution compensation makes the attack costly because negligible residual errors are needed.
Replay attack model: Imperfect gateway receiver compensation causes a constant detection-threshold shift, whereas inaccurate attacker compensation prevents faithful signature mimicry.
Machine-learning modeling attacks: Repeated access to transmitted data could allow an external attacker to model RF-PUF responses using a separate learning engine.
Machine-learning modeling attacks: Modeling accuracy depends on the ratio of accessed CRPs to total CRPs, creating a trade-off between modeling time and accuracy.

C. Countermeasures against PUF re-use Attacks

The paper considers countermeasures for repeatedly usable PUFs, focusing on erasability, certifiability, and the practical difficulty of external machine-learning attacks.

One-time-use protocols are unsuitable because RF-PUF transmitters must send data whenever required.
Erasability prevents individual PUF responses from being read again without affecting others, supporting tamper detection but requiring reconfigurability and extra control circuitry.
Certifiability requires checking a PUF response offline without an external Trusted Authority.
2^80 ≈ 10^24 CRPs for five features would require several years of external machine-learning training, despite vulnerability in principle.

D. Security and Robustness

RF-PUF security and robustness depend on balancing false acceptance and false rejection through the detection threshold, with performance varying as transmitter populations grow.

Low FAR and FRR jointly indicate secure and robust authentication, but the two metrics trade off with the detection threshold.Higher thresholds increase FAR and reduce FRR, while lower thresholds reduce FAR and increase FRR.
With approximately 50 transmitters, RF-PUF’s equal-error FAR and FRR are close to those of pairwise-compared Ring Oscillator PUF and better than other compared PUFs.
As transmitter count increases, overall error rises because inter-PUF distances decrease.
Approximately 99% accuracy is reported for detecting up to 10,000 transmitters, with receiver neural networks adding 3–5% power overhead when powered on.