A Subspace Pre-learning Approach to Fast High-Accuracy Machine Learning of Large XOR PUFs with Component-Differential Challenges

Physical Unclonable Functions (PUFs), leveraging integrated circuits' manufacturing variations to produce responses unique for individual devices, are emerging as a promising class of security hardware primitives. Implementable with simplistic circuits and requiring low operation energy, PUFs are particularly suitable for resource-constrained systems. An important part of security research is to discover all possible security risks. Such information is useful for PUF developers to design new PUFs to overcome existing risks as well as for PUF-utilizing application developers to avoid vulnerable PUFs. While physically unclonable, some PUFs have been found to be mathematically clonable by machine learning methods which can accurately predict the responses of PUFs. Mathematical clonability allows attackers to develop malicious software to impersonate PUF-embedded devices by producing the same responses PUFs would give. Existing studies on machine learning attack of PUFs have not found vulnerability of large XOR PUFs with component-differential challenges. We believe that the high dimensionality of the challenge space of such PUFs is the underlying reason for the difficulty of machine learning attacks. In this paper, we introduce a PUF-architecture-tailored subspace prelearning-based attack method that can learn the responses of such XOR PUFs fast and accurately, revealing a vulnerability of these XOR PUFs if the PUF has an interface conforming to the way challenge-response data are accessed for the subspace prelearning-based attack method.