Evaluation of Microcontroller-Based SRAM PUF and the Authentication Scheme

This paper tackles the security challenges of the Internet of Things (IoT) and introduces Physical Unclonable Functions (PUFs) as a low-cost, hardware-based security solution for resource-constrained IoT devices. Traditional password systems and centralized key management are difficult to implement in distributed IoT networks. PUFs leverage inherent fabrication variances to provide unique, non-replicable identities for devices. This study focuses on Static Random Access Memory (SRAM) PUFs, exploiting power-up values to generate device-specific keys or identifiers. Through experiment on the SRAM chip of an STM32F407ZGT6 microcontroller, we show microcontroller-based SRAM PUF can have 94.18% reliability, 48.09% uniqueness and 50.40% uniformity. It passes most of the National Institute of States and Technology (NIST) statistical tests, exhibiting good randomness. It can realize similar performance in terms of security, compared with other implementations and thus can be used as an equally qualified alternative for authentication and potentially other security applications. In addition, we propose mathematical models to compute False Rejection Rate (FRR) and False Acceptance Rate (FAR) of PUF-based authentication scheme and a threshold determination approach to mostly satisfy given FAR and FRR. The authentication scheme using the implemented SRAM PUF can realize \(8.05 \times {10}^{ - 10}\) FRR and \(2.36 \times {10}^{ - 10}\) FAR, for the case of 128-bit key length.