Physical unclonable function modeling attack resisting method based on neural network

Abstract

The invention relates to a physical unclonable function modeling attack resisting method based on a neural network. The method comprises the following steps: generating a multi-bit random bit stream by using a random seed generated by an LFSR module, and simultaneously acting PUF excitation on a plurality of physical unclonable functions to generate a multi-bit physical unclonable function response; the method comprises the following steps: constructing an initial feature matrix by utilizing a Decoder module, and equally dividing position decoding excitation into a plurality of binary position decoding sub-excitation with a certain length; sequentially guiding multi-bit physical unclonable function responses to storage units of corresponding addresses to form a physical unclonable function response feature matrix, and inputting the physical unclonable function response feature matrix into the neural network model to obtain one-bit confusion response; and the other bit of confusion response of the random seed is reutilized until a final confusion response sequence with a preset bit is generated, and the server compares the final confusion response sequence with an expected confusion response to complete identity authentication. By adopting the method, the hardware security can be improved.

Description

Technical Field

[0001] This application relates to the field of hardware security technology, and in particular to a method for resisting modeling attacks based on a physical unclonable function of a neural network. Background Technology

[0002] With the rapid advancement of artificial intelligence (AI) and the Internet of Things (IoT) technologies, AIoT devices equipped with neural network models are playing a crucial role in smart homes, healthcare, and various other fields. However, because these AIoT devices process information involving high-value assets or sensitive privacy, they are also increasingly becoming primary targets for malicious attackers. Therefore, to ensure data security, AIoT devices must undergo strict authentication before accessing confidential data.

[0003] Traditional key-based authentication mechanisms typically require storing keys in non-volatile memory (NVM). This storage method not only places a heavy burden on the hardware but also makes the NVM highly vulnerable to intrusive attacks, as attackers can steal the encryption keys stored in the NVM through reverse engineering techniques such as focused ion beam (FIB) and scanning electron microscopy (SEM). Physically Unclonable Functions (PUFs) are an emerging hardware security primitive that leverages inherent uncontrollable variations in chip manufacturing processes to generate unique chip characteristics. Due to the inherent vulnerability and unclonability of process variations, PUFs exhibit strong randomness, uniqueness, and resistance to intrusive attacks. They have been widely applied in the field of identity authentication in recent years. For example, the Arbiter PUF (APUF) is a typical PUF widely used for IoT device authentication. The entire APUF structure consists of an arbitrator and n-stage delay units, each containing two 2-to-1 multiplexers. Due to process variations in chip manufacturing, the delays of each stage of the delay unit are not exactly equal. The arbitrator outputs 0 or 1 based on the arrival speed of the signal, called the response. The control signals C0, C1, ..., Cn acting on each delay unit determine whether the signal propagates in a parallel or intersecting manner, and are called challenges. Each challenge generates a corresponding response, known as challenge-response pairs (CRPs). As the challenge bit width increases, the CRP space of the APUF grows exponentially. This characteristic makes the APUF a suitable hardware primitive for frequent authentication. However, PUF-based authentication methods are vulnerable to modeling attacks. AIoT devices and remote servers need to authenticate each other by transmitting challenge-response pairs in the channel. Once an attacker collects enough CRPs, they can use various methods to model the PUF and forge devices to gain server authorization. Although many researchers have introduced nonlinearities into the CRPs of the PUF to enhance its resistance to modeling attacks, these methods either reduce the reliability of the PUF or increase hardware overhead significantly, and most are still susceptible to modeling attacks, resulting in low hardware security. Summary of the Invention

[0004] Therefore, it is necessary to provide a neural network-based physical unclonable function anti-modeling attack method that can improve hardware security in response to the above-mentioned technical problems.

[0005] A neural network-based method for resisting modeling attacks on physically unclonable functions, the method comprising:

[0006] Construct a model for resisting modeling attacks on physically unclonable functions; the model for resisting modeling attacks on physically unclonable functions includes an LFSR module, an array of physically unclonable functions, a Decoder module, and a neural network model;

[0007] The AIoT device sends an authentication request to a remote server. After receiving the authentication request, the remote server sends a random seed generated by the LFSR module to the AIoT device.

[0008] A multi-bit random bit stream is generated using a random seed. The multi-bit random bit stream includes PUF excitation and position decoding excitation.

[0009] By using an array of physically unclonable functions, PUF excitations can be applied simultaneously to multiple physically unclonable functions to generate multi-bit physically unclonable function responses.

[0010] The Decoder module is used to construct an initial feature matrix and divide the position decoding stimulus into multiple binary position decoding sub-stimuli of a certain length. These sub-stimuli are then sequentially guided to the memory cells at the corresponding addresses to form the physical non-cloning function response feature matrix.

[0011] The physical non-clonable function response feature matrix is ​​input into a neural network model to obtain a one-bit confusing response;

[0012] The random seed is reused to generate another obfuscated response until a final obfuscated response sequence of a pre-set number of bits is generated. The AIoT device then sends the final obfuscated response sequence to a remote server, which compares the final obfuscated response sequence with the expected obfuscated response to complete the identity authentication.

[0013] In one embodiment, the LFSR module is used to generate a pseudo-random bitstream using register shifting and XOR taps, and the multi-bit random bitstream also includes weight parameters of a neural network model.

[0014] In one embodiment, the PUF array consists of multiple physically unclonable functions, all of which receive and share the PUF stimulus generated by the LFSR module and generate multiple responses.

[0015] In one embodiment, the Decoder module consists of a matrix of storage cells initialized to all "0"s and receives the position decoding stimulus generated by the LFSR module as the storage address.

[0016] In one embodiment, the neural network model is built from existing AI computing hardware in an AIoT device, taking the response feature matrix generated by the Decoder module as input, and using the NN weight parameters generated by the LFSR module to calculate and generate a confused response.

[0017] In one embodiment, generating a multi-bit random bitstream using a random seed includes:

[0018] Generate a multi-bit random bit stream L using a random seed. PUF +L Dec +L NN , where L PUF The bit is used as the PUF excitation C PUF L Dec Bits are used as position decoding excitation C Decode L NN The bit is used as the weight parameter W in the neural network model.

[0019] In one embodiment, the position decoding stimulus is divided into multiple binary position decoding sub-stimuli of a certain length, including:

[0020] Position decoding excitation C Decode Divide into n equal parts of length Binary position decoder sub-excitation {C D1 ,…,C Dn}

[0021] The aforementioned neural network-based method for resisting modeling attacks on physically unclonable functions (PUCs) involves constructing a PUC resistance model. This model comprises an LFSR module, a PUC array, a Decoder module, and a neural network model. Instead of directly sending stimuli to the AIoT device, the server sends a random seed generated by the LFSR module. The LFSR then generates subsequent stimuli acting on the PUCs, achieving stimulus obfuscation. Furthermore, the PUC responses are not simply input directly into the neural network model for obfuscation; instead, position-decoded stimuli are inserted into different positions of the response feature matrix, achieving position obfuscation. The neural network model is constructed by reusing the hardware structure of the AIoT device that performs AI computations, lightweightly implementing any neural network model. The nonlinearity of the neural network model is used to obfuscate the CRPs of the PUCs, thereby enhancing resistance to modeling attacks and improving hardware security. Moreover, due to the good fault tolerance of the neural network model, the final result remains stable even under a certain degree of noise input. Therefore, even if the original physical non-clonable function response, which is used as input to the neural network model, undergoes a certain degree of random flipping, the stability of the ambiguity response can still be guaranteed, thereby effectively ensuring the reliability of the authentication result; and since this application reuses the existing computing hardware resources in the AIoT device to implement the neural network model, no additional huge hardware overhead will be generated. Attached Figure Description

[0022] Figure 1 This is a flowchart illustrating a method for resisting modeling attacks based on a neural network-based physically unclonable function in one embodiment.

[0023] Figure 2 This is a schematic diagram of a model structure for resisting modeling attacks on physically unclonable functions in one embodiment;

[0024] Figure 3 This is a flowchart illustrating a single authentication process in one embodiment;

[0025] Figure 4 This is a schematic diagram of the LFSR module in another embodiment;

[0026] Figure 5 This is a schematic diagram of the structure of a physically non-clonable function array in one embodiment;

[0027] Figure 6 This is a schematic diagram of the Decoder module in one embodiment;

[0028] Figure 7 This is a schematic diagram of the structure of a neural network model in one embodiment. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0030] In one embodiment, such as Figure 1 As shown, a method for resisting modeling attacks based on physically unclonable functions using neural networks is provided, including the following steps:

[0031] Step 102: Construct a physically unclonable function anti-modeling attack model; the physically unclonable function anti-modeling attack model includes an LFSR module, a physically unclonable function array, a Decoder module, and a neural network model.

[0032] like Figure 2 As shown, the Physically Unclonable Function Anti-Modeling Attack Model includes an LFSR module, a Physically Unclonable Function Array (PUF-Array), a Decoder module, and a Neural Network Model (NN). The specific functions of each component are as follows:

[0033] (a) LFSR: Initialized using a random seed, and generated using register shifting and XOR taps to form a pseudo-random bit stream, which constitutes the PUF excitation, position decoding excitation and NN weight parameters respectively.

[0034] (b) PUF-Array: Consists of multiple Physically Unclonable Functions (PUFs), all of which receive and share the PUF stimuli generated by the LFSR and produce multiple responses.

[0035] (c)Decoder: It consists of a matrix of storage cells initialized to all "0"s. It receives the position decoding stimulus generated by the LFSR as the storage address, stores multiple PUF responses into the storage cells at the corresponding addresses, and generates a PUF response feature matrix.

[0036] (d)NN: Reuse existing AI computing hardware in AIoT devices, such as multipliers and adders, to implement structures such as convolutional layers and fully connected layers, thereby constructing an NN model. Using the response feature matrix generated by the Decoder as input, the NN weight parameters generated by the LFSR are used to calculate and generate a confused response.

[0037] Step 104: The AIoT device sends an authentication request to the remote server. After receiving the authentication request, the remote server sends a random seed generated by the LFSR module to the AIoT device.

[0038] An AIoT device sends an authentication request to a remote server. Upon receiving the authentication request, the remote server sends a random seed S of the LFSR (Active Logic Controller) to the AIoT device. In the authentication process of this application, the server does not directly send incentives to the AIoT device, but instead sends the random seed of the LFSR. The LFSR then generates the incentives that subsequently act on the PUF (Active Logic Controller), thereby achieving incentive obfuscation.

[0039] Step 106: Generate a multi-bit random bit stream using a random seed. The multi-bit random bit stream includes PUF excitation and position decoding excitation.

[0040] Generate using random seed S (L PUF +L Dec +L NN ) bit random bit stream, where L PUF The bit is used as the PUF excitation C PUF L Dec Bits are used as position decoding excitation C Decode L NN The bit is used as the weight parameter W of the NN.

[0041] Step 108: Use the array of physically non-cloning functions to simultaneously apply PUF excitation to multiple physically non-cloning functions to generate multi-bit physically non-cloning function responses.

[0042] PUF-Array utilizes C PUF Simultaneously applied to n PUFs, generating an n-bit PUF response {r1,…,r...}n}

[0043] Step 110: Use the Decoder module to construct an initial feature matrix and divide the position decoding stimulus into multiple binary position decoding sub-stimuli of a certain length. Then, sequentially guide multiple physically unclonable function responses to the corresponding memory units to form a physically unclonable function response feature matrix.

[0044] The Decoder module initializes a feature matrix of size w × w, consisting entirely of zeros (which can be of length w). The binary representation of C is the address of any position. Decode Divide into n equal parts of length Binary position decoder sub-excitation {C D1 ,…,C Dn}, sequentially guiding PUF responses {r1,…,r n The PUF response is then incorporated into the feature matrix corresponding to the address, thereby forming the PUF response feature matrix M. In the authentication process of this application, the PUF response is not simply input directly into the NN for obfuscation, but rather inserted into different positions of the response feature matrix using positional decoding excitation, thus achieving positional obfuscation.

[0045] Step 112: Input the physical non-clonable function response feature matrix into the neural network model to obtain a one-bit confusing response.

[0046] The PUF response feature matrix M is input into the NN with weight parameters W to calculate and generate a one-bit confusion response R1.

[0047] Step 114: Reuse the random seed to generate another obfuscated response until a final obfuscated response sequence of a pre-set number of bits is generated. The AIoT device then sends the final obfuscated response sequence to a remote server. The server compares the final obfuscated response sequence with the expected obfuscated response to complete the identity authentication.

[0048] Repeat steps 106 to 112 until an m-bit obfuscated response sequence R' = {R1, ..., R...} is generated. m After generating the m-bit obfuscated response R', the AIoT device sends R' to the remote server. The server compares R' with the expected obfuscated response to complete authentication. The AIoT device does not send the original PUF response to the server; instead, it sends an obfuscated response using a non-linear mapping applied by a neural network, thus achieving response obfuscation.

[0049] The aforementioned neural network-based method for resisting modeling attacks on physically unclonable functions (PUCs) involves constructing a PUC resistance model. This model comprises an LFSR module, a PUC array, a Decoder module, and a neural network model. Instead of directly sending stimuli to the AIoT device, the server sends a random seed generated by the LFSR module. The LFSR then generates subsequent stimuli acting on the PUCs, achieving stimulus obfuscation. Furthermore, the PUC responses are not simply input directly into the neural network model for obfuscation; instead, position-decoded stimuli are inserted into different positions of the response feature matrix, achieving position obfuscation. The neural network model is constructed by reusing the hardware structure of the AIoT device that performs AI computations, lightweightly implementing any neural network model. The nonlinearity of the neural network model is used to obfuscate the CRPs of the PUCs, thereby enhancing resistance to modeling attacks and improving hardware security. Moreover, due to the good fault tolerance of the neural network model, the final result remains stable even under a certain degree of noise input. Therefore, even if the original physical non-clonable function response, which is used as input to the neural network model, undergoes a certain degree of random flipping, the stability of the ambiguity response can still be guaranteed, thereby effectively ensuring the reliability of the authentication result; and since this application reuses the existing computing hardware resources in the AIoT device to implement the neural network model, no additional huge hardware overhead will be generated.

[0050] In one embodiment, the LFSR module is used to generate a pseudo-random bitstream using register shifting and XOR taps, and the multi-bit random bitstream also includes weight parameters of a neural network model.

[0051] In one embodiment, the PUF array consists of multiple physically unclonable functions, all of which receive and share the PUF stimulus generated by the LFSR module and generate multiple responses.

[0052] In one embodiment, the Decoder module consists of a matrix of storage cells initialized to all "0"s and receives the position decoding stimulus generated by the LFSR module as the storage address.

[0053] In one embodiment, the neural network model is built from existing AI computing hardware in an AIoT device, taking the response feature matrix generated by the Decoder module as input, and using the NN weight parameters generated by the LFSR module to calculate and generate a confused response.

[0054] In one embodiment, generating a multi-bit random bitstream using a random seed includes:

[0055] Generate a multi-bit random bit stream L using a random seed.PUF +L Dec +L NN , where L PUF The bit is used as the PUF excitation C PUF L Dec Bits are used as position decoding excitation C Decode L NN The bit is used as the weight parameter W in the neural network model.

[0056] In one embodiment, the position decoding stimulus is divided into multiple binary position decoding sub-stimuli of a certain length, including:

[0057] Position decoding excitation C Decode Divide into n equal parts of length Binary position decoder sub-excitation {C D1 ,…,C Dn}

[0058] In a specific embodiment, such as Figure 3 As shown, AIoT devices require an m = 128-bit obfuscated response sequence R' = {R1, ..., R...} 128 Used for single authentication; the structure of the LFSR module is as follows: Figure 4 As shown, its order (i.e., the width of the random seed S) is s = 64 bits, and the tap coefficients are determined by the primitive polynomial; the structure of the PUF-Array is as follows. Figure 5 As shown, it consists of n = 4 APUFs, and all APUFs share the same L. PUF =64-bit PUF stimulus C PUF A total of 4 PUF responses {r1, r2, r3, r4} are generated; the Decoder structure is as follows: Figure 6 As shown, it uses a storage depth of w initialized with all "0"s. 2 =4 2 =16 BRAM as the core (the address of any position can be represented by a 4-bit binary number), used to store Write by Bit position decoding stimulus C Decode Generate the response feature matrix M at the specified matrix address; the structure of NN is as follows: Figure 7 As shown, in this embodiment, the input layer of the NN is read from BRAM at a depth of 16 (=4). 2The neural network (NN) requires 128 random weights (16 × 8 = 128 bits) for its response feature map, without any weight parameters (or with weights considered as all 1s). The hidden layer is a binary fully connected layer containing 8 neurons, all of which are interconnected with the 16 neurons in the input layer, requiring 16 × 8 = 128 bits of random weights. The output layer is a binary fully connected layer containing only 1 neuron, interconnected with the 8 neurons in the input layer, requiring 8 bits of random weights. Therefore, the NN requires a total of 136 (=128+8) bits of random weights W (for simplicity, bias parameters are not used in this embodiment).

[0059] Step 1: The AIoT device sends an authentication request to the remote server. After receiving the authentication request, the remote server sends the random seed S of the LFSR to the AIoT device.

[0060] Step 2: The LFSR generates a 216-bit random bitstream using a random seed S, of which 64 bits are used as the PUF stimulus C. PUF 16 bits are used as the position decoding excitation C Decode 136 bits are used as the weight parameters W of the NN.

[0061] Step 3: PUF-Array utilizes C PUF Simultaneously applied to 4 PUFs, generating 4-bit PUF responses {r1, r2, r3, r4}.

[0062] Step 4: The Decoder initializes the 16-bit BRAM with all "0"s (the address of any location can be represented by a 4-bit binary number), and sets the 16-bit C... Decode Decomposed into four 4-bit binary position decoder sub-excitations C D1 C D2 C D3 C D4 The BRAM write addresses of the PUF responses r1, r2, r3, and r4 are used to form the PUF response feature matrix M.

[0063] Step 5: Input the response feature matrix M into the NN with weight parameter W to calculate and generate a one-bit confusion response R1.

[0064] Step 6: Repeat steps 2 through 5 until a 128-bit obfuscated response sequence R' = {R1, ..., R} is generated. 128 After generating the 128-bit obfuscated response R', the AIoT device sends R' to the remote server. The server compares R' with the expected obfuscated response to complete the authentication.

[0065] It should be understood that, although Figure 1The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but may be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0066] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0067] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for resisting modeling attacks based on physically unclonable functions using neural networks, characterized in that, The method includes: A physically unclonable function (PLF) model resistant to modeling attacks is constructed. The PLF model includes an LFSR module, a physically unclonable function array, a Decoder module, and a neural network model. The AIoT device sends an authentication request to a remote server, and the remote server, upon receiving the authentication request, sends a random seed generated by the LFSR module to the AIoT device. A multi-bit random bit stream is generated using a random seed, the multi-bit random bit stream including PUF excitation and position decoding excitation; The PUF excitation is applied simultaneously to multiple physically unclonable functions using an array of physically unclonable functions to generate multi-bit physically unclonable function responses. The Decoder module is used to construct an initial feature matrix and divide the position decoding stimulus into multiple binary position decoding sub-stimuli of a certain length. These sub-stimuli are then sequentially guided to the memory cells at the corresponding addresses to form the physical non-cloning function response feature matrix. The physical non-clonable function response feature matrix is ​​input into a neural network model to obtain a one-bit confusing response; The device reuses another obfuscated response from a random seed until a final obfuscated response sequence of a pre-set number of bits is generated. The AIoT device then sends the final obfuscated response sequence to a remote server, which compares the final obfuscated response sequence with the expected obfuscated response to complete the authentication process.

2. The method according to claim 1, characterized in that, The LFSR module is used to generate a pseudo-random bit stream using register shifting and XOR taps. The multi-bit random bit stream also includes weight parameters of a neural network model.

3. The method according to claim 1, characterized in that, The PUF array consists of multiple physically unclonable functions. All physically unclonable functions receive and share the PUF excitation generated by the LFSR module and generate multiple responses.

4. The method according to claim 1, characterized in that, The Decoder module consists of a matrix of storage cells initialized to all "0"s, and receives the position decoding stimulus generated by the LFSR module as the storage address.

5. The method according to claim 1, characterized in that, The neural network model is built using existing AI computing hardware in the AIoT device. It takes the response feature matrix generated by the Decoder module as input and uses the NN weight parameters generated by the LFSR module to calculate and generate a confused response.

6. The method according to claim 1, characterized in that, Generating a multi-bit random bit stream using a random seed includes: Generate a multi-bit random bit stream L using a random seed. PUF +L Dec +L NN , where L PUF The bit is used as the PUF excitation C PUF L Dec Bits are used as position decoding excitation C Decode L NN The bit is used as the weight parameter W in the neural network model.

7. The method according to claim 1, characterized in that, The position decoding stimulus is divided into multiple binary position decoding sub-stimuli of a certain length, including: Position decoding excitation C Decode Divide into n equal parts of length Binary position decoder sub-excitation {C D1 ,…,C Dn }

Images