Lightweight and Privacy-Preserving Reconfigurable Authentication Scheme for IoT Devices

The Internet of Things (IoT) has revolutionized connectivity by enabling a large number of devices to autonomously exchange real-time data over the Internet. However, IoT devices used in public spaces are vulnerable to physical and cloning attacks. To address this issue, researchers have introduced the concept of physical-unclonable functions (PUFs) to enhance security in IoT applications. While PUF-based security solutions typically rely on static challenge-response behavior, many practical applications require dynamic or reconfigurable PUFs. For instance, PUF-based key storage may require updating or revoking secrets, and protection against modeling attacks, where an attacker can derive a PUF model from a set of challenge-response pairs (CRPs) using learning capabilities. In this paper, we introduce LR-OPUF, a reconfigurable one-time PUF, and propose a lightweight and privacy-preserving authentication scheme based on this LR-OPUF foundation. One notable feature of our authentication scheme is that it enables a device to prove its legitimacy to a semi-honest verifier without disclosing the CRPs. Through security and performance analyses, we demonstrate that our approach not only ensures vital security aspects but also exhibits high computational efficiency.