A Unified Open-Set Framework for Scalable PUF-Based Authentication of Heterogeneous IoT Devices

Summary

This paper authenticates Internet of Things (IoT) devices from the physical fingerprint of their hardware, using one classifier for several kinds of fingerprint. A physical unclonable function (PUF) is a circuit whose response to a challenge depends on random manufacturing variation, so each chip answers differently. The framework turns responses from Arbiter, SRAM, DRAM, and mixed PUF fleets into images and trains an open-set classifier, a model that identifies enrolled devices and also rejects devices it has never seen. It reaches 100% closed-set accuracy with up to 45 devices, and a Raspberry Pi server finishes one authentication in 0.67 seconds.

Key numbers

• 100%Closed-set accuracy on every dataset, with up to 45 enrolled devices, where prior classification-based schemes covered 3 to 5
• 0.44% / 0.43%False acceptance and false rejection rates for a mixed fleet of 20 Arbiter and 25 SRAM PUFs
• 0.67 sEnd-to-end authentication time on a Raspberry Pi 5 server, about 30× faster than the BCNN baseline and 9× faster than PUF-Phenotype

Method

A PUF ^[1][2] derives a hardware fingerprint from manufacturing variation, and the pairs of challenge and response (CRPs) it produces serve as proof of identity. Strong PUFs such as the Arbiter PUF (APUF, which races two signals through a chain of switches) accept many challenges but return one bit each. Weak PUFs such as SRAM and DRAM PUFs expose the startup state of memory cells. Existing authentication schemes are specific to one PUF type, store large CRP databases, or train a model of the PUF, and modeling invites machine learning attacks.

The framework encodes any PUF response as a 50 × 50 grayscale image. For an APUF, a linear feedback shift register (LFSR, a cheap pseudorandom sequence generator) expands one stored challenge into 20,000 challenges, and the response bits are packed into 8-bit pixels. For SRAM and DRAM PUFs, the cell array is cropped to the same size. Each device's images are collected repeatedly, so the classifier learns device-specific features that tolerate noise instead of memorizing one noise-free template.

The classifier is built on OpenGAN ^[3]. A ResNet-18 first learns a K-way classifier over the K enrolled devices. A generator and discriminator then train on its features, with the generator producing synthetic outliers, so no real impostor images are needed. A device is accepted only if the discriminator's open-set confidence exceeds a threshold and the predicted identity matches the claimed one. In the protocol, the device encrypts its image with a fresh AES session key, wraps the key under the server's public key, and sends both. The server checks the wrapped key against a Bloom filter ^[4], a compact set-membership structure, to reject replays.

Evaluation

The datasets cover 25 APUFs on FPGA boards, 40 SRAM PUFs from a public set of 144 devices, a noisy DRAM set measured at 20 to 50°C and 1.27 to 1.5 V, and a heterogeneous fleet. Closed-set accuracy is 100% on all of them. For 25 APUFs the false acceptance rate (FAR) is 0.35% and the false rejection rate (FRR) is 0%. For 40 SRAM PUFs against more than 5,000 unauthorized queries, FAR is 0.13% and FRR is 0.62%. On the noisy DRAM set, FAR is 0.33% and FRR is 2.04%, where the BCNN baseline rejects 10.64% of enrolled queries. A single classifier authenticates the heterogeneous fleet of 20 APUFs and 25 SRAM PUFs with 0.44% FAR and 0.43% FRR.

The prototype uses a Raspberry Pi 5 as the server and two Ultra96-V2 boards with APUFs as a legitimate device and an impostor. One authentication cycle takes about 0.67 s, which includes encryption, communication, and classifier inference of 33.5 GFLOPs, and each request carries 2,958 bytes. A 2.4 MB Bloom filter supports one million sessions at a 0.01% false positive rate.

Limitations

The largest fleet has 45 devices, and the APUF fleet is 36 instances placed on six FPGA boards. Noisy DRAM data comes from three enrolled devices. Fleets of thousands of devices are not tested. Enrollment takes place in a secure environment and trains the classifier on images from every legitimate device, so adding devices requires retraining.

Response noise is a real constraint: the instability of the public SRAM set averages 5.85% and reaches 26.74%, and the DRAM FRR of 2.04% is the highest of the four datasets. The security argument rests on the encrypted channel, because plaintext PUF images would expose responses to replay and modeling attacks. The prototype runs over Wi-Fi with two boards, not a deployed network.

Citation

@inproceedings{wang2026openpuf,
  title={A Unified Open-Set Framework for Scalable PUF-Based Authentication of Heterogeneous IoT Devices},
  author={Xin Wang and Peichun Hua and Chip Hong Chang and Wenye Liu and Yue Zheng},
  booktitle={IEEE International Conference on Systems, Man, and Cybernetics (SMC)},
  year={2026},
  organization={IEEE}
}

References

1. Ravikanth Pappu, Ben Recht, Jason Taylor, and Neil Gershenfeld. Physical One-Way Functions. Science, 2002. doi.org/10.1126/science.1074376
2. Yansong Gao, Said F. Al-Sarawi, and Derek Abbott. Physical unclonable functions. Nature Electronics, 2020. doi.org/10.1038/s41928-020-0372-5
3. Shu Kong and Deva Ramanan. OpenGAN: Open-Set Recognition via Open Data Generation. ICCV, 2021. arxiv.org/abs/2104.02939
4. Burton H. Bloom. Space/time trade-offs in hash coding with allowable errors. Communications of the ACM, 1970. doi.org/10.1145/362686.362692